Article View: comp.security.misc
Article #346Re: Hiding Processes from ps -ax
From: Steven Geyer
Date: Sat, 12 Sep 1992 13:49
Date: Sat, 12 Sep 1992 13:49
36 lines
2167 bytes
2167 bytes
>flaps@dgp.toronto.edu (Alan J Rosenthal) writes: >>avalon@coombs.anu.edu.au (Darren Reed) writes: >>Some people reported that "ps" showed "rn ut". > >I never saw those articles; on what system does it do this??!??!? That is, if >you zero out the rest of the name as my article said. This would be extremely >bizarre behaviour and I'm quite sceptical that it exists. > >>Here, it shows "rn (a.out)". >>eg, I commonly have this: >>18570 p8 I 0:01 -tcsh (tcsh) > >This is not the same situation. Did my program actually show "rn (a.out)" or >are you extrapolating? On what OS? There is a kludge in ps for when the >argv[0] begins with a minus sign. On SunOS 4.1.1 at least, it also seems to be >triggered by having a completely empty name, as you create later. Neither of >these are methods I suggested because neither of them achieves the desired >results. How about... the minus sign means that it is a login shell. >>However, if you can get the pid of a process then you can also >>get the inode number of it too > >Processes don't have inode numbers. Files have inode numbers. One can still dump an core image of the process and rummage through to find out who and what was happening. Still not safe for a hacker. Well Jay, it looks like we are out of luck (or not! ... depending on which side of the line you reside ;-) -- Steven A. Geyer <geyer@is.morgan.com> // if (get_standard_disclaimer()) UNIX IS Dept. // USE_IT(); else Morgan Stanley & Co., Inc. // it_is_only_my_unforced_opinion();
Technical Details
Message-ID:
<1992Sep12.094950@is.morgan.com>Path:
arc1-ca.pugleaf.net!sparky!uunet!s5!is1.is.morgan.com!is.morgan.com!geyerReferences:
<sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr> <1992Sep11.004815.23118@jarvis.csri.toronto.edu>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!s5!is1.is.morgan.com!is.morgan.com!geyer From: geyer@is.morgan.com (Steven Geyer) Subject: Re: Hiding Processes from ps -ax Message-ID: <1992Sep12.094950@is.morgan.com> Sender: news@is.morgan.com Nntp-Posting-Host: alicia Organization: Morgan Stanley References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr> <1992Sep11.004815.23118@jarvis.csri.toronto.edu> Date: Sat, 12 Sep 1992 13:49:50 GMT Lines: 36